Buggy code:
public class PropertyOrFieldReference extends SpelNodeImpl { private final String name ; private volatile PropertyAccessor cachedReadAccessor ; private volatile PropertyAccessor cachedWriteAccessor ; private final boolean nullSafe ; public PropertyOrFieldReference ( boolean nullSafe , String propertyOrFieldName , int pos ) { } @ Override public TypedValue getValueInternal ( ExpressionState state ) throws EvaluationException { TypedValue result = readProperty ( state , this . name ) ; TypeDescriptor resultDescriptor = result . getTypeDescriptor ( ) ; <START_BUG> if ( ( ( ( result . getValue ( ) ) == null ) && ( state . configuredToCreateCollectionOrMap ( ) ) ) && ( nextChildIs ( Indexer . class , PropertyOrFieldReference . class ) ) ) { <END_BUG> if ( ( resultDescriptor . getType ( ) . equals ( List . class ) ) || ( resultDescriptor . getType ( ) . equals ( Map . class ) ) ) { if ( resultDescriptor . getType ( ) . equals ( List . class ) ) { try { if ( isWritable ( state ) ) { List newList = ArrayList . class . newInstance ( ) ; writeProperty ( state , name , newList ) ; result = readProperty ( state , this . name ) ; } } catch ( InstantiationException e ) { throw new SpelEvaluationException ( getStartPosition ( ) , e , SpelMessage . UNABLE_TO_CREATE_LIST_FOR_INDEXING ) ; } catch ( IllegalAccessException e ) { throw new SpelEvaluationException ( getStartPosition ( ) , e , SpelMessage . UNABLE_TO_CREATE_LIST_FOR_INDEXING ) ; } } else { try { if ( isWritable ( state ) ) { Map newMap = HashMap . class . newInstance ( ) ; writeProperty ( state , name , newMap ) ; result = readProperty ( state , this . name ) ; } } catch ( InstantiationException e ) { throw new SpelEvaluationException ( getStartPosition ( ) , e , SpelMessage . UNABLE_TO_CREATE_MAP_FOR_INDEXING ) ; } catch ( IllegalAccessException e ) { throw new SpelEvaluationException ( getStartPosition ( ) , e , SpelMessage . UNABLE_TO_CREATE_MAP_FOR_INDEXING ) ; } } } else { try { if ( isWritable ( state ) ) { Object newObject = result . getTypeDescriptor ( ) . getType ( ) . newInstance ( ) ; writeProperty ( state , name , newObject ) ; result = readProperty ( state , this . name ) ; } } catch ( InstantiationException e ) { throw new SpelEvaluationException ( getStartPosition ( ) , e , SpelMessage . UNABLE_TO_DYNAMICALLY_CREATE_OBJECT , result . getTypeDescriptor ( ) . getType ( ) ) ; } catch ( IllegalAccessException e ) { throw new SpelEvaluationException ( getStartPosition ( ) , e , SpelMessage . UNABLE_TO_DYNAMICALLY_CREATE_OBJECT , result . getTypeDescriptor ( ) . getType ( ) ) ; } } } return result ; } @ Override public void setValue ( ExpressionState state , Object newValue ) throws SpelEvaluationException { } @ Override public boolean isWritable ( ExpressionState state ) throws SpelEvaluationException { } @ Override public String toStringAST ( ) { } private TypedValue readProperty ( ExpressionState state , String name ) throws EvaluationException { } private void writeProperty ( ExpressionState state , String name , Object newValue ) throws SpelEvaluationException { } public boolean isWritableProperty ( String name , ExpressionState state ) throws SpelEvaluationException { } private List < PropertyAccessor > getPropertyAccessorsToTry ( Class < ? > targetType , ExpressionState state ) { } String getName ( ) { } }

Fix:
if ( ( ( ( result . getValue ( ) ) == null ) && ( state . configuredToDynamicallyCreateNullObjects ( ) ) ) && ( nextChildIs ( Indexer . class , PropertyOrFieldReference . class ) ) ) {